curl -X POST https://yourapp.com/api/queue \
  -H "x-checkpoint-key: cpk_live_<YOUR_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "<p>Hi Alex, quick question about your Q3 roadmap...</p>",
    "confidence": 0.91,
    "segment": "outbound-email",
    "on_approve_webhook": "https://your-pipeline.com/send-email"
  }'

// Express handler — verify signature, then carry out the action
app.post(
  "/webhooks/checkpoint",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.headers["x-checkpoint-signature"];
    const event = req.headers["x-checkpoint-event"];

    const expected = "sha256=" + crypto
      .createHmac("sha256", process.env.WEBHOOK_SECRET!)
      .update(req.body)
      .digest("hex");

    if (expected !== sig) return res.status(401).send("Bad signature");

    const payload = JSON.parse(req.body.toString());

    if (event === "on_approve") {
      // Send the email — use payload.content as the reviewed body
      await mailer.send({ to: payload.metadata.prospect, html: payload.content });
    }

    if (event === "on_regenerate") {
      // Produce a new version and POST it back to the SAME item, echoing the
      // regenerate_token from the payload. Do NOT create a new /api/queue item —
      // that would abandon the original and leave it stuck "regenerating".
      const fresh = await generateEmail(payload.metadata);
      await fetch(
        `https://yourapp.com/api/queue/${payload.id}/regenerated`,
        {
          method: "POST",
          headers: {
            "x-checkpoint-key": process.env.CHECKPOINT_API_KEY,
            "Content-Type": "application/json",
          },
          body: JSON.stringify({
            content: fresh,
            regenerate_token: payload.regenerate_token,
          }),
        }
      );
    }

    res.status(200).send("OK");
  }
);

// Call before generating — inject rules into your system prompt
const res = await fetch("https://yourapp.com/api/feedback?segment=outbound-email", {
  headers: { "x-checkpoint-key": process.env.CHECKPOINT_API_KEY! },
});
const { style_rules, examples } = await res.json();

const systemPrompt = `
You are a B2B sales assistant. Write concise, professional outbound emails.

Style rules (from reviewer edits):
${style_rules.map(r => "- " + r.rule_text).join("\n")}

Recent edit examples (original → approved):
${examples.slice(0, 3).map(e =>
  `Before: ${e.original}\nAfter:  ${e.edited}`
).join("\n\n")}
`.trim();